Design and Verification of Adaptive Cache Coherence Protocols ...

Specification Implementation
t 0
A
B
2.5.1 Veri cation of Soundness
t
t
1
2
B
A
t
3
s0
A1
B1
s
s
1
2
s3 A2 B1
B1
A1
B2
Figure 2.10: Forward Draining
We use simulation to prove the soundness of an implementation. We rst build a mapping
function that maps an implementation term to a speci cation term, and then show that the
speci cation can simulate the implementation with respect to the mapping function. We de ne
the mapping function based on the notion of drained terms or drained states. Intuitively,
a drained implementation term contains no partially executed operation and therefore can
be trivially mapped to a speci cation term via a projection function (or a combination of a
projection function and a lift function).
Based on the concept of drained terms, the implementation terms are classi ed into equiva-
lent classes where each equivalent class contains exactly one drained term as the representative
of the class. A term can be rewritten to a drained term via forward or backward draining.
Forward draining means that the term can be rewritten to the corresponding drained term ac-
cording to some implementation rules backward draining means that the drained term can be
rewritten back to the term itself according to some implementation rules. Intuitively, forward
draining completes partially executed operations, while backward draining cancels partially ex-
ecuted operations and recovers the system state. We can specify a set of draining rules so that
for each implementation term, its normal form with respect to the draining rules represents a
drained term.
Figure 2.10 shows the use of forward draining. The speci cation allows t0 to be rewritten
to t3 by applying rules A and B the order in which the rules are applied does not matter. The
implementation takes two consecutive steps to achieve the semantic e ect of each speci cation
rule: A1 and A2 for rule A, and B1 and B2 for rule B. The application of rules A1 and A2
can be interleaved with the application of rules B1 and B2. It is obvious that s0, s3, s5 and
s8 are drained terms that correspond to t0, t1, t2 and t3, respectively. We can use forward
draining to drain other implementation terms by completing partially executed operations this
can be achieved by chosing A2 and B2 as the draining rules. Therefore, s1 is drained to s3, s2
is drained to s5, and s4, s6 and s7 are drained to s8.
Figure 2.11 shows the use of backward draining in a non-con uent system. The speci cation
allows t0 to be rewritten to t3 or t4, while applying rules A and B in di erent orders can lead
38
s
4
s5
A2
B2
A1
s
s
6
7
B2
A2
s8